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IN THE CLAltVfS: 

Claims 1-8 (previously canceled) 

9. (previously amended) A method in a data processing system for managing an 
information request, comprising: 

establishing a session, including authenticating a client based on a presented 
credential; 

generating a session identi fication in response to the session being established; 
associating the presented credential with session data; 
sending the session identification to the client; 

receiving a request lor information and a credential and the session identification 
from the client; 

determining whether the session identification is valid; 

determining whether the credential is valid for both the client and the session 

data; 

sending the information to the client in response to the session identification and 
the credential being valid. 

10. (original) The method of claim 9, wherein ihc credential is a user name and 
password, a security token, or a certificate. 

1 1 . (original) The method of claim 9, further comprising: 

associating a user account with the session identification in response to the 
credential being valid. 

1 2. (original) The method of claim 9, wherein the step of generating a session 
identification comprises generating a random number. 

13. (original) The method of claim 9, wherein ihc step of generating a session 
identification comprises generating a session idenlification data structure. 
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14. (original) The method ordaim 13, wherein the session identification data 
structure is a session identification cookie. 

15. (original) The method of claim 13, wherein the session identification data 
structure is in a rewritten uniform resource locator, 

1 6. (original) The method of claim 9, wherein the request is a hypertext transport 
protocol request, 

1 7. (original) The meLhod of claim 1 6, wherein the hypertext transport protocol 
request is a uniform resource locator. 

Claims 18-21 (previously canceled) 

22. (original) A method in a data processing system for managing an information 
request, comprising: 

receiving a request for information and a session identification and a first 
credential from a client; 

determining whether the session identification is valid; 

retrieving a session data structure including a second credential in response to the 

session identification being valid; 

determining whether the first credential and the second credential match; and 
fulfilling the request for information in response to the first credential and the 

second credential mulching. 

23. (original) The method of claim 22, wherein the first credential is a user name and 
password, a security token, or a certificate. 

24. (original) The method of claim 22, wherein the step of generating a session 
identification comprises generating a random number. 
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25. (original) The method of claim 22, wherein the step of generating a session 
identification comprises generating a session identification data structure, 

26. (original) The method of claim 25, wherein the session identification data 
structure is a session identification cookie. 

27. (original) The method of claim 25, wherein the session identification data 
structure is in a rewritten uniform resource locator. 

28. (original) The method of claim 22, wherein the request is a hypertext transport 
protocol request. 

29. (original) The method of claim 28, wherein the hypertext transport protocol 
request is a uniform resource locator, 

Claims 30-37 (previously canceled) 

3S. (previously amended) An apparatus for managing an information Tequcst, 
comprising; 

session means for establishing a session, including authenticating a client based 
on a presented credential; 

generating means for generating a session identification in response to the session 
being established; 

association means for associating the presented credential with session data; 
first sending means for sending the session identification to the client; 
receipt means for receiving a request for information and a credential and the 
session identification from the client; 

first determining means for determining whether the session identification is 

valid; 

second determining means for determining whether the credential is valid for both 
the client and the session data; and 
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second sending means for sending the information to the client in response to the 
session identification and the credential being valid. 

39. (original) The apparatus of claim 38, wherein the credential is a user name and 
password, a security token, or a certificate. 

40. (original) The apparatus of claim 38, further comprising: 

association means for associating a user account with the session identification in 
response to the session identification being generated. 

41 . (original) The apparatus of claim 38, wherein the generating means comprises 
moans for generating a random number. 

42. (original) The apparatus of claim 38, wherein the generating means comprises 
means for generating a session identification data structure. 

43. (original) The apparatus of claim 42, wherein the session identification data 
structure is a session identification cookie. 

44. (original) The apparatus of claim 42, wherein the session identification data 
structure is in a rewritten uniform resource locator, 

45. (original) The apparatus of claim 38, wheroin the request is a hypertext transport 
protocol request. 

46. (original) The apparatus of claim 45, wherein the hypertext transport protocol 
request is a uniform resource locator. 

Chiims 47-50 (previously canceled) 
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5 1 . (original) An apparatus for managing an information request, comprising: 
a processor; and 

a memory electrically connected to the processor, the memory having stored 
therein a program lo be executed on the processor for performing; 

receiving a request for information and a session identification and a first 
credential from a client; 

determining whether the session identification is valid; 

retrieving a session data structure including a second credential in 
response to the session identification being valid; 

determining whether the first credential and the second credential match; 

and 

fulfilling the request for information in response to the first credential and 
the second credential matching. 

52. (original) The apparatus ofclaim 51, wherein the first credential is a user name 
and password, a security token, or a certificate, 

53. (original) The apparatus ofclaim 51, wherun the step of generating a session 
identification comprises generating a random number. 

54. (original) The apparatus of claim 51, wherein the step of generating a session 
identification comprises generating a session identification data structure. 

55. (original) The apparatus ofclaim 54, wherein the session identification data 
structure is a session identification cookie. 

56. (original) The apparatus ofclaim 54, whemin the session identification data 
structure is in a rewritten uniform resource locator. 

57. (original) The apparatus of claim 51, wherein the request is a hypertext transport 
protocol request. 
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58. (original) The apparatus of claim 57, wherein the hypertext transport protocol 
request is a uniform resource locator. 

Claim 59 (previously canceled) 

60. (previously amended) A computer program product, in a computer readable 
medium, for managing an information request, comprising: 

instructions for establishing a session, including authenticating a client based on a 
presented credential; 

instructions for generating a session identification in response to the session being 
established; 

instructions for associating the presented credential with session data; 

instructions for sending the session identification to the client; 

instructions for receiving a request for information and a credential and the 
session identification from a clienL; 

instructions for determining whether the session identification is valid; 

instructions for determining whether the credential is valid for both the client and 
the session data; 

instructions for sending the information to the client in response to the session 
identification and the credential being valid. 

Claim 61 (previously canceled) 

62. (original) A computer program product, in a computer readable medium, for 
managing an information request, comprising: 

instructions for receiving a request for information and a session identification 
and a first credential from a client; 

instructions for determining whether the session identification is valid; 

instructions for retrieving a session data structure including a second credential in 
response to the session identification being valid; 

instructions for determining whether the first credential and the second credential 
match; and 
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instructions for fulfilling the request for information in response to the first 
credential and the second credential matching. 

63. (previously added) A method in a data piocessing system for managing an 
informalion request, comprising: 

authenticating a client based on a presented credential; 

generating a session identification in response to the client being authenticated; 

associating the presented credential with session data; 

sending the session identification to the client; 

receiving a request for information and a credential and the session identification 
from the client; 

determining whether the session identification is valid; 

determining whether the credential is valid lor both the client and the session 
data; and 

sending the information to the client in response to the session identification and 
the credential being valid. 
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